SECURITY
Built like a system of record.
Compliance evidence is only worth something if it can be trusted. EVA protects who can get in, keeps each organization’s data to itself, and makes its records hard to change and easy to check.
ACCESS
Only the right people, and you can see who.
Passkeys and two-factor sign-in
Sign in with a passkey (fingerprint, face, or device PIN) or add an authenticator-app code with one-time recovery codes.
Lockout on repeated failures
Repeated wrong passwords or codes lock the account for a while and notify its owner. A passkey still works, so an attacker cannot lock out the real user.
Sessions you can see and end
Every signed-in device is listed with when and where it was last used. Sign out any of them, or all of them, at once. Sessions expire daily.
Roles
Admins manage the organization; reviewers do the reviews. Integrations use separate API keys that can be revoked at any time.
YOUR DATA
Separate, private, encrypted.
Isolated workspaces
Each organization’s documents, results, and reports are kept apart from every other organization’s. Files are private and only served after EVA checks who is asking.
Encrypted in transit and at rest
All traffic uses HTTPS with strict transport security. Stored data and files are encrypted at rest by our hosting providers.
Hosted in the United States
EVA runs on Vercel, with its database and file storage in the United States. Payments are handled by Stripe; card details never reach our servers.
INTEGRITY
Records that hold up.
An append-only audit trail
Sign-ins, uploads, deletions, reviews, decisions, and exports are recorded with who, what, and when. The record survives even when the data it describes is deleted.
Tamper-evident reports
Reports and data packets are fingerprinted when they are made and served unchanged after that. The packet lists a fingerprint for every file inside it.
Failure that stays honest
If any step fails partway through a review, the review is marked failed and says so. An outage can never produce a passing result.
REPORT A SECURITY ISSUE
If you believe you have found a vulnerability in EVA, tell us before disclosing it publicly. We will confirm we received it and keep you informed while we fix it.
Contact securityQuestions from your QA team?
We are happy to walk your quality or IT reviewers through how EVA handles access, data, and records.